Commit6c99633

committed

gis-8557 clean rule name inside query in splunk-spl-rule-yml

1 parent4adffd5 commit6c99633Copy full SHA for 6c99633

File tree

-0

lines changed

-0

lines changed

Lines changed: 4 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -29,6 +29,7 @@`
`29`	`29`
`30`	`30`	`classSplQueryParser(PlatformQueryParser):`
`31`	`31`	`log_source_pattern=r"^___source_type___\s=\s(?:\"(?P<d_q_value>[%a-zA-Z_:0-9\-/]+)\"\|(?P<value>[%a-zA-Z_:0-9\-/]+))(?:\s+(?:and\|or)\s+\|\s+)?"# noqa: E501`
	`32`	+rule_name_pattern=r"`(?P<name>(?:[:a-zA-Z0-9=+%#\-_/,;`?~‘\'.<>$&^@!\]\[()\s]))`"
`32`	`33`	`log_source_key_types= ("index","source","sourcetype","sourcecategory")`
`33`	`34`
`34`	`35`	`platform_functions:SplFunctions=None`
`@@ -53,6 +54,9 @@ def _parse_log_sources(self, query: str) -> tuple[dict[str, list[str]], str]:`
`53`	`54`	`returnlog_sources,query`
`54`	`55`
`55`	`56`	`def_parse_query(self,query:str)->tuple[str,dict[str,list[str]],ParsedFunctions]:`
	`57`	`+ifre.match(self.rule_name_pattern,query):`
	`58`	`+search=re.search(self.rule_name_pattern,query,flags=re.IGNORECASE)`
	`59`	`+query=query[:search.start()]+query[search.end():]`
`56`	`60`	`query=query.strip()`
`57`	`61`	`log_sources,query=self._parse_log_sources(query)`
`58`	`62`	`query,functions=self.platform_functions.parse(query)`

Comments

(0)